diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1b1de9e55..b795dde19 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -17,6 +17,8 @@ updates:
           - "k8s.io/cli-runtime"
           - "k8s.io/client-go"
           - "k8s.io/kubectl"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "gomod"
     target-branch: "main"
     directory: "/"
@@ -32,6 +34,8 @@ updates:
           - "k8s.io/cli-runtime"
           - "k8s.io/client-go"
           - "k8s.io/kubectl"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "github-actions"
     target-branch: "main"
     directory: "/"
@@ -41,6 +45,8 @@ updates:
       github-actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
   - # Keep dev-v3 GitHub Actions up to date, while Helm v3 is within support
     package-ecosystem: "github-actions"
     target-branch: "dev-v3"
@@ -51,3 +57,5 @@ updates:
       github-actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 9503674ed..136754568 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
+        with:
+          persist-credentials: false
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"
       - name: Setup Go
@@ -26,6 +28,7 @@ jobs:
         with:
           go-version: '${{ env.GOLANG_VERSION }}'
           check-latest: true
+          cache: false
       - name: Test source headers are present
         run: make test-source-headers
       - name: Check if go modules need to be tidied
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 76358c3c4..49e310fe5 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -45,6 +45,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 955f12002..2a359568d 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
+        with:
+          persist-credentials: false
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"
       - name: Setup Go
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2b2f93f4d..87b8caaa0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,8 @@ on:
     branches:
       - main
 
-permissions: read-all
+permissions:
+  contents: read
 
 # Note the only differences between release and canary-release jobs are:
 # - only canary passes --overwrite flag
@@ -23,6 +24,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"
@@ -38,8 +40,8 @@ jobs:
         run: |
           set -eu -o pipefail
 
-          make build-cross VERSION="${{ github.ref_name }}"
-          make dist checksum VERSION="${{ github.ref_name }}"
+          make build-cross VERSION="${GITHUB_REF_NAME}"
+          make dist checksum VERSION="${GITHUB_REF_NAME}"
 
       - name: Set latest version
         run: |
@@ -88,6 +90,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"